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SOME EFFECTS OF BIAS ERRORS IN 
REDUNDANT FLIGHT CONTROL SYSTEMS 


Robert F. Stengel 
Charles Stark Draper Laboratory 
Massachusetts Institute of Technology 
Cambridge, Massachusetts 


Abstract 

The controllability and steady-state response 
of parallel-redundant flight control systems are 
examined. It is found that state components which 
appear in the parallel signal paths, e.g., individual 
actuator commands, are not controllable, although 
the sum of the command signals is well-behaved. 
If the response modes associated with these compo- 
nents are not stable, bias errors can cause the 
components to diverge, leading to the possibility 
of 'nuisance trips" in failure detection/isolation 
logic and eventual control system lockup (at satura- 
tion). Combining the inputs to the control computers 
assures that sensor bias will not cause divergence, 
while cross-strapping control strings boundsdiver- 
gent response to all bias error inputs. Results of 
numerical solutions confirm the problem and its 
solutions. 


Introduction 

In order to achieve acceptable levels of reli- 
ability and to meet fail-operational requirements, 
electronic ("fly-by-wire") and automatic-landing 
control system s require redundant strings of control 
system elements (a control string is a single repli- 
cation of the sensors, logic and effectors necessary 
for vehicle control). During time-critical phases 
of a flight, e.g., a final approach in conditions of 
poor visibility, or for aircraft which depend on the 
control system for safety-of-flight (control- 
configured vehicles), each control string must 
continuously provide current actuator command 
solutions. These command solutions form a basis 
for failure detection (through comparison or voting) 
which is independent of the control law and which 
does not rely on built-in test procedures. Under 
certain conditions, however, the simultaneous solu- 
tions from individual strings can diverge, even 
though every string is operating without failure. 
In such an instance, the failure-detection logic may 
select out one or more strings, causing a so-called 
"nuisance trip". Nuisance trips lower the margin 
of safety and could cause unnecessary aborts. They 
can occur in systems of control strings which are 
well-designed individually, leading to a requirement 
for channel equalization and/or restrictions on 
multiple- string operation. 1 ' 2 

The principal reason that the control strings 
of a redundant system can diverge is that each string 
contains errors, however small, which are not the 
same as the errors in the other strings. At the 
same time, each string senses the same vehicle 
motion and (ultimately) commands the same control 


effector. A properly designed string operating alone 
would control the vehicle and limit its own errors; 
however, when confronted with the errors of many 
strings and a single effector to control them, the 
redundant system can become uncontrollable in the 
rigorous sense, as will be shown in the next section. 
The net command to the control effector, whether 
obtained by averaging, mid -value selection, or ac- 
tive-standby selection, may be well-behaved while 
one or more individual commands diverge. This 
behavior is illustrated by the results of numerical 
simulation in a later section. 

If measurements are not perfect and if oper- 
ating time is not so short that the limits of diver- 
gence are acceptable, the redundant control system 
must be protected against nuisance trips. The 
following sections of this paper will show that there 
are three ways of protecting against actuator com- 
mand divergence caused by system errors. The 
most restrictive solution is to assure that the 
redundant control elements do not contain pure 
integration, i.e., that they do not introduce new 
components to the system state. The second solution 
is to feed identical control error signals to each 
set of control computers. The third method is to 
stabilize the uncontrollable modes of the control 
loops by "equalization" or "cross- strapping". 

Controllability of Redundant Systems 

The purpose of this section is to show that 
parallel-redundant control systems are not com- 
pletely controllable if any of the system's state 
components appear in the redundant paths. This 
result is completely general, in that no amount of 
coupling or feedback restores complete controlla- 
bility to the system (although such coupling can 
indeed have a beneficial effect). 

A dynamical system is said to be completely 
controllable if the n components of its state, x(t), 
can be driven from an arbitrary initial condition, 
x(0), to null in finite time, T, by the application of 
a suitable control history, u(t), 0 < t < T, where 
u(t) is the p-vector of controllnputs to the dynamical 
system. For the linear, time-invariant system 
described by 


i(t) = Fx(t)+Gu(t) 


(1 


a necessary and sufficient condition for complete 
controllability is that the matrix, T , defined by 

r = [g, fg £ <n " 1, £] (2 
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be of rank n, i.e., that it contains at least one 
non-zero nxn determinant. 3 In such a case, u(t) is 
said to span the state space, for its influence can 
be felt by all of the state components. 
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A prototype for dual-redundant control is 
illustrated in Fig. 1. Each sensor and controller 



Fig. 1. State-space diagram of a fully-coupled, 
redundant control system. 

of the corresponding m-redundant system, as well 
as the single aircraft /actuator system, is repre- 
sented by a matrix equation for the states, x, with 
constant-coefficient matrices; 


is. 

Is 2s. + Ss Hs. ■ 

1 = 1, m 

(3 

ic i 

Ic 2-Cj + Sc He. ’ 

i = 1, m 

(4 

X A 

= Ia2a + SaHa 


(5 


These can be observed through the corresponding 
measurement vectors, 



Ms 2s. + 2s Hs. 

L = 1, m 

(6 


‘ M c 2c. + N c , 

i = 1, m 

(7 

£a. 

= Ma2a 


(8 


Referring to Fig. 1, it can be seen that the 
inputs, u, to each component of this feedback system 
are comprised of the outputs of the other compo- 
nents plus the desired input, uq. As the system is 
posed here, it allows for multiple-inputs and mul- 
tiple-outputs as well as higher-order dynamics in 
any element. It further specifies that each redundant 
element is identical to the other elements of like 
kind and that the outputs of the control strings are 
summed at the actuator. The aircraft /actuator 
measurement vector (Eq. 8) does not contain the 
inputs to that block; however. Fig. 1 shows that these 
are available for cross-feed to other control strings, 
and they are implicitly available for feedback within 
the controller through the definition of Fq. Using 
this figure and letting m = 2, the dynamical equations 
(Eq. 3-5) become 


^ ' Is + Ss <M A 2 A > (9 

^s 2 = Isis 2 + gs <M A 5 A > (10 

“ = Ic + Sc [ 2( “d ' 2sMa 2 a > ■ is^Sj + ^S 2 ) ] (n 


ic 2 " Ic ic 2 + 2c [ 2I -D ' IsI!a£a ) " Ms ( 2Sj + iSj 1 ] (12 

2a = Ia 2a + Sa + ic 2 ’ + 2c [ 2( “d - 2sMa2 A > 

- M S (Xg i + 5S 2 >]) 113 


These equations can be combined in a single 
matrix equation for a state vector which consists 
of all plant and controller components. As an 
intermediate step, the state components of each 
control string can be combined in a single vector, 
and the dynamical equation can be expressed in the 
following partitioned form: 



The order of the combined system is n = mq+r, 
where m is the redundancy level, q is the number 
of sensor-plus-controller state components and r 
is the number of aircraft and actuator state compo- 
nents. 

From Eq. (9 - 12), the first two rows of matrix 
coefficients in Eq. (14) are identical; hence, the 
observability matrix, £, of Eq. (2) takes the form. 


Si [<Il + l2>Sl + l3 Sal 
2i[‘Si + £a>Si*l3 S 2 ]’ 
§2 [<£4 + S5>Sl + Is S2] 


(15 


It can be seen that the top two rows of matrix 
coefficients in £ are identical and that, for q-order 
control strings, at least q rows will be duplicated 
in the dual-redundant version. Duplication of even 
one row in £ reduces its rank below n; therefore, 
if any of the system states occur in the identical 
control strings, the most general redundant system 
cannot be completely controllable. 

A simple example illustrates the point. Let 
the aircraft/actuator dynamics consist only of a 
first-order lag, while the sensor has no dynamic 
effect and the controller consists of proportional- 
plus-integral compensation. The non-redundant 
system of equations is 


1 


- g c 

x c 

+ 

1 

crq 

l>J 


g A (f A " g A ’ 

X A 


|_ g Aj 


and it has the controllability matrix 


g C g C g A 

g A [« A * S A »g A " g C g A ] _ 


(17 


The determinant of Eq. (17) is, in general, 
not equal to zero, and the system is completely 
controllable. Adding a second control string (without 
cross- strapping) gives an equation of the form 
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The determinant of the corresponding T is 
of the form 


ized for k<0. Further examination shows that the 
transfer function x^(s)/up>(s) is the same with or 
without cross-strapping. 

This section has shown that redundant control 
systems are never completely controllable but that 
cross-strapping (or equalization)can stabilize the 
uncontrollable modes (which are still uncontrol- 
lable) and, therefore, limit divergence. 


irl -- | G, FG, f 2 gi 


C e g 

C e g * 0 

2b d f 


(19 


and the dual-redundant version is not completely 
controllable. Cross- strapping would eliminate the 
zeros in Eq. (18) but would not change the form 
of T. 

It might be pointed out that a number of 
parallel-redundant autoland systems are in daily 
use and that this is in seeming contradiction with 
the present result. One can readily deduce from 
these results that the uncontrollability is only partial 
and that it is connected with the controller states. 
The airplane /actuator state components are as 
controllable as they were for simplex control, but 
intermediate components, e.g., actuator commands 
and controller error signals, may not be. 

Reference 3 points out that a partially control- 
lable system can be acceptable if the uncontrollable 
part is stable. Alternatively, an unstable or neu- 
trally stable system could be acceptable with the 
assurance that the offending modes would never be 
excited. Looking again at the example of Eq. (18), 
the characteristic equation of the dual-redundant 
system without cross-strapping is 


|s_l - Fl 


s 0 c 

0 s c 

-b -b (s-a) 


s(s* 


- as + 2bc) 


0 


(20 


The neutral root represented by the "free" ,s 
in Eq. (20) is a potential source of trouble, since 
it indicates a pure-integration response mode. 
Thus, a bias input can cause a ramp output. If, 
however, the outputs of the controllers are aver- 
aged, the difference between theactuator commands 
of the individual strings and the average can be used 
as an error signal which tells each string how far 
from the average its output lies. These error 
signals. 


f i 


- (x„ 


>/2 


X - (x + X )/2 (21, 22 

^2 ^1 ^2 


can be used to "equalize" the actuator commands 
if each is fed back to its controller with appropriate 
sign. The error signals are frequently integrated, 
for good long-term tracking of the redundant actu- 
ator commands, as in the SPZ-1 autoland system 
of the B-747. 2 In the example of Eq. (18), a similar 
result is achieved by feeding the signals back to 
the respective controllers with a gain of 2k, yielding 
the characteristic equation 


(s-k) k c 

k (s-k) c = 

-b -b (s-a) 


s 3 - (2k + a)s 2 + 2(ak + bc)s - 4bck 


0 (23 


Equation (23) can be factored to (s-2k) 
• (s 2 -as+2bc)=0, and the neutral mode is stabil- 


Steady-State Response to Bias Errors and Noise 

Single-input, single-output transfer functions 
are used here to describe the effects of bias and 
noise injected at the sensor, controller, and actuator 
inputs of a parallel-redundant control system. As 
in the previous section, the system is assumed to 
be linear and time-invariant; consequently, the 
combination of signals implies summing, although 
many of the results are qualitatively similar for 
mid-value selection. Independent- string, com- 
bined-input, and cross- strapped redundant systems 
are discussed in turn. 

It is convenient to replace the dual-redundant 
model of the previous section with the independent- 
string block diagram of Fig. 2. In this figure. 



n. Is) 


Fig. 2. Block diagram of an independent-string, 
dual -redundant flight control system 


sensor, controller, and aircraft /actuator transfer 
functions are denoted by S(s), C(s), and A(s) respec- 
tively. The Laplace transforms of the system input 
and output are u(s) and x(s), while the j** 1 control 
signal transform of the i** 1 control string is ey(s) 
The bias and noise inputs at the sensor, controller, 
and actuator for the ith system are ng^(s), ng^(s), 
and nAi(s). The actuator commands, e^ls) are 
averaged at the actuator. 

Using block-diagram algebra, the output 
transform of an m-redundant independent- string 
system is 



£ n A + C Til + -L V (n c - Sn s )] j /(I + ACS) 


(24 


It can be seen that x(s)/u(s) = AC/(1+ACS), 
as expected, and that each of the error inputs is 
attenuated by the averaging process. 

The intermediate control signals, which con- 
sist of n controller inputs and m actuator commands, 
can be expressed as the matrix 


3 








The solution to Eq. (28) is 


,n 


0 (s) 


E = B R 


(36 


E(s) 

I : 

...!«>> e m2 <s) 

The i ^ controller input transform is 

m m 

e u - U-^ r X( Cn C t +n A„) + V C I e kl] 

m - k=1 k k 1 k=l 

th 

while the i actuator command transform is 

m 

e i2 ■ c |-c:f[vI( n A-u)l) 


(25 


where 


a b b 

b a b 

b b a 


(3 7 


(26 


and 


(27 


a = [ 1 + (m - 1 > 8] / (1 + m0) * [1 + {.52iI)aCS]/(1 + ACS) 
b = - 8/(1 + m|9) = - (d-)ACS/(l + ACS) 


(38 


(39 


Equations 26 and 27 can be combined in the The control signal transforms of the first 

matrix equation string are then 



BE = | , 

(28 

e ll = a r ll + br 21 + • ' 

• + br ml ■ 

(40 

where 



e 12 = ar 12 + br 22 + - • 

• + br m2 • 

(41 


"(1+9) 9 9 

8 (l+.fl) 8 


8 9 (1+9) 


R 


C II 12 ] 


u - S(p + n s ) 


u - S(p + n y ) 


u + n r - S( 6 + nc ) 
. C 1 b l 


u + n r - S(6 + nc ) 


S' J 


and 


8 - ACS/m 


P ■ — Y (C n c + n i 
k=l K * 


A I "A 


and those of the remaining strings are similarly 
( m y m) (29 defined. The transfer functions between error inputs 
and control signals are obtained by substitution of 
the appropriate definitions in Eq. (40) and (41). 

-The transfer functions for the actuator command 
are particularly important. They can be expressed 
in terms of the basic closed-loop transfer function, 

(mx2> (30 H(s) ■ ACS/ (1 + ACS), (42 


which is assumed to be well-behaved and whose time 
response to a step input is bounded as time-~°o. 
For a dual-redundant control system, the actuator 
command transfer functions are 


e 12 (s) _ _H_ 

u(s) AS 


(43 


(32 


2 (s) 

(s) 


e 12 (s) 

n a (s) 
A 2 


5H 


e 12 (s) . -(!+. 5ACS)H 

lie (s) A 

S 1 


(44 


(45 


(33 

(34 


(35 


0 (s) 


nc (s) 
b 2 


. 5CSH 


e 12 (s> _ (1+. 5ACS)H 

n-, (s) AS 


9 (s) 


n r (s) 
u 2 


5CH 


(46 


(47 


(48 
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By the final- value theorem, the limit of actu- 
ator command response to a unit- step error input 
is 


lim e(t) = llm s ( - ) * lim (49 

t— os s — 0 n(s) x s ' s -* 0 n(s) 


If any transfer function contains an "s" di- 
visor, the corresponding actuator command re- 
sponse is unbounded. This might occur in a variety 
of ways, but the most common would be integration 
in the sensor or controller. In the case of propor- 
tional-plus-integral compensation, C(s) = k(s+a)/s, 
and Eq. (45) to (48) show that sensor or controller 
biases cause the actuator command to diverge. 
Response to sensor bias in the first string (Eq. (45)) 
causes negative divergence, while a bias in the 
second string (Eq. (46)) causes positive divergence. 
By similarity, a bias in the first string's sensor 
causes negative divergence in the first string and 
positive divergence in the second string; hence, the 
averaged output of the two actuator commands is 
well-behaved. The same response pattern obtains 
for controller bias. The steady- state rate of diver- 
gence is found by multiplying Eq. (45 - 48) by s 
and taking the limit as s — 0. Consequently, higher- 
order integral compensation causes a higher degree 
of divergence in the redundant system. 

This result assumes that there is no commun- 
ication between the control strings. If, however, 
the inputs from each string are averaged and sent 
to every string, there is a common controller input 
signal given by 


In this case, the response to sensor bias is 
independent of the compensation, and the most 
important form of actuator command divergence can 
be avoided. Combination of controller inputs suc- 
ceeds in eliminating the sensor bias-induced diver- 
gence because each string has the same response 
to a particular error. It has no effect on errors 
arising in the controllers, which are "downstream" 
of the combining process. 

The third alternative, cross-strapping the 
actuator commands, allows each string to sense the 
commands of the other strings. Choosing the 
difference between the individual command and the 
average command as the feedback variable. 


- I 


k2 


(55 


The controller output, as well as the actuator 
input, should be bounded; furthermore, the control 
compensation can have beneficial effect on the 
cross- strapping signal. It is assumed, therefore, 
thate;g is fedback to its own system with compensa- 
tion, K(s), as illustrated by Fig. 3(b). The controller 



b) "Cros$-Stfapping"or Equalization of Control Strings 


<s) = i[v A K +Cn cJll /<1+ACS) 

k=l K K K 


(so Fig. 3 Methods of coupling redundant control strings 


and the i^ 1 


actuator command transform is 


input transform is unchanged by this modification, 
but the i th actuator command transform becomes 




The previous equations can be used, letting 
R = r 2 and 


with 


u + n r - c 


u + € 


(52 


S_ 

m 


l (\ + A "A k ) 

k=l K K 


(53 


Combining the sensor outputs, as shown in 
Fig. 3(a), has no effect on the actuator command 
response to desired input, actuator error and con- 
troller error; however, the transfer functions for 
dual-redundant response to sensor error become 


e 12 (s) _ e 12 (s> 


n Q (s) rio (s) 
b l ^2 


5H/A 


(54 


5 and r 2 (Eq. (28) and (32)) are modified by 
the cross- strapping, as indicated by Eq. (56); how- 
ever, the most important effect of cross- strapping 
can be deduced from Eq. (56), noting that the 
multiplier of both n c .and ng^ C/(1-CK) rather than 

C. As a consequence, the multiplier is bounded as 
s-»0,and response to sensor and controller errors 
is no longer divergent. 

Results of Numerical Simulation 

A model for a triply-redundant digital flight 
control system for the space shuttle orbiter is used 
to illustrate the effects of a pitch-angle measure- 
ment bias during landing approach. The linear, 
time-invariant differential equations for longitu- 
dinal motion are integrated numerically to obtain 
these results. In all cases, a 1° pitch bias is imposed 
att=lsec. This large bias would reflect an abnormal 
condition rather than a nominal error within system 
specifications; however, the model is linear, and 
the response modes are independent of the bias 
magnitude. Reducing the bias magnitude by a factor 
of 100 reduces the response magnitudes bythesame 
factor. 
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Redundant configurations with a variety of 
controller input and output combination philosophies 
have been simulated. In all cases, the control 
compensation of the fifth-order dynamic model 
consists of pitch-rate damping with proportional- 
plus-integral pitch-attitude compensation. The 
triplex-actuator commands drive the model through 
an averaged command, a mid-value selected com- 
mand, or through a single-string command. The 
three controllers receive independent, average, 
weighted-average, or mid-value selected sensor 
outputs. A series of runs with independent inputs, 
averaged outputs, and varying cross-strapping gains 
also is presented. 

Figure 4 illustrates the effect of a pitch bias 
in one string on the elevator, pitch, and pitch-rate 
response of the vehicle. The average output of the 



Fig. 4 The effect of a 1 pitch bias in one of three 
control strings. Elevator command is ob- 
tained by averaging the outputs of the re- 
dundant strings. This vehicle response is 
obtained with independent inputs, combined 
inputs, and cross-strapping. 

three strings is well-behaved, and the pitch angle 
assumes a steady-state value which is 1/3 the bias 
magnitude. This response pattern is the same for 
both independent- and averaged inputs to the three 
controllers. The actuator commands of the three 
strings with independent inputs are compared with 
the average command in Fig. 5. The. negative 
divergence of the offending string is opposed by the 
remaining good strings, and the difference in com- 
mands would eventually cause a "nuisance trip" of 
the failure detection mechanism. Averaging the 
inputs as well as the outputs provides the response 
shown in Fig. 6, where all commands are seen to 
be well-behaved. 

The problem of independent inputs without 
cross- strapping per sists for active- standby config- 
urations. If the biased string is controlling with 
the good strings in "standby", the good strings 
observe the vehicle's response to the measurement 
bias and generate opposing commands (which have 
no effect on the vehicle), as shown in Fig. 7. Figure 
8 illustrates the converse, with a good string con- 
trolling and a biased backup string. In this case 
there is no vehicle response, but the backup com- 
mand diverges (reaching an imposed -90° limit on 
output signals). 

These results are summarized and are com- 
pared with weighted-average and mid-value selec- 
tion in Table I, which lists command response at 
t=20 sec. to a 1-deg bias imposed on string #1 at 




Fig. 5 Divergence of commands from individual 
strings in an independent-string triplex 
control configuration. (Sign of actuator 
command reversed by elevator servo 
model. ) 



Fig. 6 Identical commands from triplex control 
strings with combined inputs. 


t=l sec. In no case does the combined actuator 
command diverge; however, all cases with indepen- 
dent inputs have individual string divergence. Both 
averaging and mid-value selection of the inputs 
prevent divergence. The latter has the additional 
advantage of rejecting the biased data, thus issuing 
no command in response to the single error. 

A possible alternative to averaging which 
causes each string to rely on its own data most 
heavily is weighted averaging. In this approach, 
each controller uses 50% of its own sensor's output 
and 25% of each of the remaining outputs (rather 
than multiplying each by 1/3 in the straight aver- 
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ACTUATOR COMMAND 
( deg ) 


X 


Table I. Effect of Input and Output Combination 

on Actuator Command Bias Response {in deg. ) 



Input 

Output 

#1 Command 

#2, #3 Command 

Actuator Command 

Independent Average 

-80. 7 

40. 3 

- 0.046 

" 

Mid-Value 

-90. 

0 . 

0 . 

" 

String #1 

- 0. 14 

90. 

- 0. 14 

tr. 

String #2 

-90. 

0 . 

0 . 

Average 

Average 

- 0. 046 

- 0.046 

- 0.046 

" 

Mid-Value 

- 0. 046 

- 0.046 

- 0. 046 

Mid-Value 

Average 

0 . 

0 . 

0 . 

" 

Mid -Value 

0 . 

0 . 

0 . 

Weighted 

Average 

-20. 2 

10. 0 

- 0.048 


Average 


Fig. 7 Divergence of backup commands in triplex 
active -standby configuration when active 
string (#1) has bias. 



Fig. 8 Divergence of backup string with bias (#1) 
in active-standby configuration (#2 is ac- 
tive). Net command to system is zero. 



Fig. 9 Bounded response to pitch bias when control 
strings are coupled by equalization or cross- 
strapping. (Coupling gain = . 05. ) 


aging approach). This scheme preserves a greater 
degree of autonomy for each string, giving better 
inherent protection against "hardover ,f failures (but 
it is not as good as mid-value selection in that 
respect). Unfortunately, weighted averaging does 
not eliminate bias-induced divergence; it only slows 
it down. The reason is that weighted averaging does 
not prevent the neutrally stable mode introduced 
by integral compensation from being forced; this 
occurs only when all strings receive the same 
information. 

Cross-strapping stabilizes the neutral mode, 
as shown by Fig. 9. It does not yield identical 
commands from each string, as input combination 
does, but it protects against errors within the 
controllers them selves. Table II indicates the level 
of commands from the three flight controllers at 
t=20 sec., and it provides a warning against using 


Table II. Effect of Cross -St rapping on Actuator 
Command Bias Response (in deg. ) 


Coupling Gain 

#1 Command 

#2, #3 Command 

Actuator Command 

0 . 

-80. 7 

40.3 

- .046 

. 01 

-36.4 

18. 1 

- .048 

. 02 

-21. 

10.7 

" 

.05 

- 9. 

4.4 

" 

. 1 

- 5.5* 

2. 7* 

» 


$ 

Oscillatory 
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too high a coupling gain with digital control. The 
cross-feed signal necessarily lags the controller 
compensation by one sampling period, causing oscil- 
lation of the individual commands at high gain 
(although the average does not exhibit the oscilla- 
tion). The nearly steady-state difference of 13.4° 
for a coupling gain of .05 is excessive, but then so 
is the 1° bias. For more reasonable measurement 
biases, cross- strapping should reduce the tracking 
error of the three strings to an acceptable level. 

Conclusion 

Good single- string control design does not 
assure that a redundant version of the same system 
will be operationally acceptable. While it is rela- 
tively easy to obtain similar response to controls 
from both simplex and multiplex control systems, 
the individual behavior of the redundant control 
strings can fool failure detection logic, triggering 
"nuisance trips", and can lead to eventual control 
system lockup, when the individual strings have 
diverged to saturation. In those cases where reini- 
tialization of actuator commands is feasible, it may 
be possible for redundant, independent control 
strings to provide an in-flight maintenance capa- 
bility, but when safety-of-flight is dependent on 
correct control without interruption, further pre- 
cautions must be taken. This is especially true 
for high-order control compensation. 

It has been shown that redundant control 
systems can be completely controllable only if all 
system states are external to the redundant control 
paths, and that integral compensation, in particular. 


can cause command response to sensor or controller 
errors to be divergent. Combining sensor outputs 
so that each control computer receives the same 
inputs prevents divergence caused by sensor bias 
and allows actuator commands to track with zero 
relative error (assuming identical string dy- 
namics). It doesnot protect against divergence due 
to controller bias. Cross-strapping, i.e., feeding 
the difference between individual command sand the 
average (or median) back to the respective control- 
lers, bounds the errors due to both kinds of biases 
by stabilizing the uncontrollable modes of the redun- 
dant control loops. Proportional feedback does not 
eliminate command tracking error in the example 
shown here, although compensation of the cross- 
feeds could do so. It appears that both input 
combination and cross- strapping should be 
employed in the redundant control system to achieve 
design and operational flexibility. 
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